2026-11-05
Trigger.dev Security Incident (November 2026): Root API Keys and Environment Variables Accessed for 0.66% of Customers, Regenerate Keys and Rotate Secrets
Trigger.dev, a platform for running background jobs and AI agents, disclosed a security incident on November 1, 2026 and published a follow-up report on November 6. The company says infrastructure alerts flagged anomalous activity on November 1, it judged the activity malicious and blocked the attacker. The incident affected 0.66% of all customers. The attacker obtained root API keys for some customer environments; a root key grants full access to an environment's settings, including its environment variables. In some environments the attacker also listed recent runs, deployments and schedules, which returned IDs, task names, run idempotency keys, run status, tags, deployment metadata and errors, schedule external IDs and run metadata. The company says it found no evidence that other customer data, other services, its own production databases or customer dashboard accounts were accessed. It is not disclosing the attack vector, to protect the investigation and customers. Affected customers were contacted by email (on November 1 and 2) and through a dashboard banner (timing not stated), and the potentially impacted API keys were revoked. Affected customers should regenerate their API keys and rotate credentials in the affected environments, such as database passwords and third-party API keys, revoking the old ones at the provider. The company says customers who got no impact notification were not affected, webhook signing secrets were not exposed, and self-hosted deployments were not impacted. This site's take: check the email and the dashboard banner first, then regenerate keys and rotate credentials as the company instructs if you are affected.